Introduction
Jamiyah Home for the Aged (JHA) cares for elderly, frail, and destitute residents 24 hours a day from a single site in Tampines. That combination makes the home unusually sensitive to disruption. An outbreak, a power failure or the loss of a key supplier does not just inconvenience JHA; it can quickly put residents' health and safety at risk. Risk assessment is how JHA finds these threats before they find it.
This chapter explains how JHA should identify, analyse, evaluate and prioritise the risks of disruption to its critical services and the resources they depend on. It aligns with clause 8.2.3 of ISO 22301:2019 (with Amendment 1:2024) and with the expectations of the Ministry of Social and Family Development (MSF). It builds on the context analysis in Chapter 7 and the planning assumptions in Chapter 5, and it works alongside the business impact analysis (BIA) introduced in Chapter 8. The resulting risk register will inform the continuity strategies and plans in eBooks 2 and 3.
Why Risk Assessment Matters for JHA
A BIA asks what happens if a service stops. A risk assessment asks what is likely to make it stop. Both are needed. Without the BIA, JHA would not know which services to protect first; without the risk assessment, it would not know which threats to protect them against, or where a modest investment could prevent a serious disruption.
For JHA, three features raise the stakes. Residents depend on the home for shelter, food, supervision and access to medical care, so any interruption quickly becomes a welfare issue. The home operates from one site, so a single event can affect every service at once. JHA's continuity framework already classifies most critical services as Tier 1, to be recovered within four hours, leaving little room for slow or improvised responses.
For example, if JHA relies on a single caterer for halal meals, the risk assessment would flag that dependency long before a supplier failure exposes it at dinner time. The home could then arrange a standby caterer, keep a small stock of ready meals or agree a mutual support arrangement with another home (illustrative).
Regulatory Expectations That Shape the Risk Assessment
MSF and the Social Residential Homes Act
JHA is one of the welfare homes gazetted by MSF and run by social service agencies as managing agents. The Social Residential Homes Act 2025 (SRHA) has been in operation since 1 July 2026 and is supported by five sets of regulations and a Code of Practice issued in July 2026. The Code covers incident management as one of its five domains, alongside management of the home, premises and facilities, case management and resident management. The Act also gives MSF step-in and enforcement powers.
MSF's public pages do not describe a specific business continuity or risk assessment requirement for welfare homes. JHA should therefore read the Code of Practice and the General Regulations carefully for any requirements on emergency preparedness, incident reporting and contingency arrangements, and map them into its risk criteria [verify]. Where formal requirements are absent, JHA should treat ISO 22301 and good sector practice as the benchmark, while recognising that MSF's expectations on resident safety and incident management will shape how any disruption is judged.
Public health and infection control
Infectious disease is one of JHA's most significant risks. During the COVID-19 pandemic, Singapore's long-term care facilities applied national infection prevention guidelines for long-term care facilities published in 2018, suspended in-person visits and operated split zones with fixed staff [verify current guidelines applicable to welfare homes]. The Infectious Diseases Act 1976 provides the legal basis for public health measures [verify specific application to JHA]. JHA's risk assessment should test whether it could implement similar measures again at short notice.
Data, technology and third parties
The Personal Data Protection Act 2012 (PDPA) applies to the personal data JHA holds about residents and staff, so a data breach or loss of records is both a continuity risk and a compliance risk [verify]. The revised Code of Governance for Charities and IPCs (2023), which Jamiyah Singapore applies on a "comply or explain" basis, asks charities to have policies covering IT, data privacy, cybersecurity and data protection. Many of JHA's services also depend on suppliers and on services provided centrally by Jamiyah Singapore, so third-party and shared-service risk must be in scope.
Board and senior management oversight
Both ISO 22301 and good charity governance expect leaders to understand and own the organisation's principal risks. The risk assessment should therefore produce outputs that the Superintendent and Jamiyah Singapore's board can read quickly and act on, as described later in this chapter.
Aligning with ISO 22301
Clause 8.2.3 of ISO 22301 asks the organisation to implement and maintain a process to identify risks of disruption to its prioritised activities and the resources they require, analyse and evaluate those risks, and decide which require treatment. This is the core of this chapter.
It is important to distinguish clause 8.2.3 from clause 6.1. Clause 6.1 concerns risks and opportunities to the business continuity management system (BCMS) itself, such as the risk that staff turnover leaves the programme without a coordinator, or the opportunity to align business continuity management (BCM) with the new licensing regime. Clause 8.2.3 concerns risks of service disruption, such as an outbreak or a power failure. JHA should keep the two in separate sections of its register to avoid confusion.
Clause 8.2.3 also connects to its neighbours. Clause 8.2.2 tells JHA which services matter most and how quickly they must be restored, so risks to Tier 1 services deserve the closest attention. The results of both analyses then feed clause 8.3, where JHA selects continuity strategies and solutions. ISO 31000:2018 offers useful general guidance on risk management principles and process, and ISO 22313:2020 offers BCM-specific guidance.
A Practical Risk Assessment Method for JHA
Step 1: Set the scope, criteria and appetite
The scope should match the BCMS scope agreed in Chapter 8: all services at the Tampines premises and the 17 critical services across Operations, Programme and Therapy, Social Work and Support. The criteria define how likelihood and impact will be rated and what level of risk requires treatment.
Risk appetite expresses how much risk leaders are willing to accept. For a welfare home, appetite for risks to resident safety is likely to be very low, while appetite for short delays to routine programmes may be moderate. If Jamiyah Singapore has an enterprise risk management framework, JHA's criteria should use the same scales and categories, so that continuity risks can be compared with other organisational risks. For example, JHA might adopt a rule that any risk rated "very high" for resident safety must be reported to Jamiyah Singapore's board within one month (illustrative).
Step 2: Identify threats and vulnerabilities
Threats are events that could cause disruption; vulnerabilities are weaknesses that worsen the disruption. The JHA should review each critical service and ask what it depends on across six resource categories: people, premises, technology, information, suppliers and partners, and utilities. For each dependency, ask what could make it unavailable and how quickly that would affect residents.
For example, supervision of residents (CBF-4 Supervision of residents) depends on having enough trained staff on each shift, working lighting and communication devices. Threats to that service include staff illness, transport disruption that stops staff from reaching Tampines, and power failure at night (illustrative).
Step 3: Analyse likelihood and impact
Rate each risk for likelihood and impact on a five-point scale, using the sample scales in Tables 9.1 and 9.2. The rating is the product of the two scores, from 1 to 25. Rate impact against the worst credible outcome across several categories, not just money, because the most serious consequences for JHA concern residents' safety and well-being.
Ratings should consider existing controls. A risk of power failure is lower if emergency lighting is already in place and tested; it is higher if lighting depends on a single circuit. JHA should record both the current rating, with existing controls, and the target rating after planned treatment.
Step 4: Evaluate risks against criteria
Evaluation compares each rating with the agreed criteria to decide what needs action. A simple banding works well: 1–4 low, accept and monitor; 5–9 medium, treat where cost-effective; 10–14 high, treat with a planned action and named owner; 15–25 very high, treat urgently and report to the board (illustrative). Risks that affect Tier 1 services may warrant treatment even at a medium rating.
Step 5: Decide on treatment
ISO 31000 describes several ways to treat risk, grouped into four practical options. JHA can avoid a risk by stopping the activity that creates it, reduce it by lowering likelihood or impact, transfer it (for example through insurance or contracts), or accept it when the cost of treatment outweighs the benefit. In continuity terms, reducing impact often means preparing a workaround, which links the treatment decision directly to the strategies in eBook 2.
For example, JHA cannot avoid the risk of extreme heat, but it can reduce its impact by identifying cooler areas, monitoring residents during heatwaves and arranging backup power for fans or air-conditioning in a designated area (illustrative).
Step 6: Look for single points of failure and concentration risk
A single point of failure is any resource whose loss would stop a critical service with no alternative. Concentration risk arises when several services depend on the same resource. For JHA, the single site is itself a concentration risk. Other examples might include a single dialysis transport provider, a single meal supplier, a single person who manages medication records, or a single IT system for case files (illustrative).
Dependencies on Jamiyah Singapore also need attention. If finance, human resources or IT support are provided centrally, an incident at Jamiyah Singapore could affect JHA even when the home itself is unaffected. These shared-service dependencies should appear in the register with an owner on each side.
Step 7: Maintain the register, owners and review cycle
Every risk in the register needs an owner, normally the head of the department most affected, and a review date. The BCM coordinator maintains the register and the steering committee reviews it at least quarterly in the first year. JHA should also review it after any significant incident, exercise or change, such as a new supplier or a change in MSF requirements.
Step 8: Involve the right people
Good risk assessment draws on people who know the work. JHA might run one two-hour workshop per department, led by the BCM coordinator, with the department head, experienced front-line staff and, where relevant, a night-shift representative (illustrative). Short interviews with suppliers, MSF officers or Jamiyah Singapore's shared-service managers can fill gaps. Workshops work best when participants start from real scenarios, such as "the power fails at 2 am", rather than abstract lists.
JHA's Threat Landscape
The threat landscape below reflects JHA's sector, operating model and location. It gives most weight to threats that affect resident safety and Tier 1 services.
Infectious disease outbreaks
Infectious disease is the most significant threat to a residential home. The first COVID-19 cluster in a Singapore nursing home surfaced on 1 April 2020, and studies of that period found that dormitory-style living and staff moving between wards raised infection risk. An outbreak at JHA could affect residents and staff at once, reduce staff numbers, end family visits and require zoning of the premises. Influenza, gastrointestinal illness and tuberculosis are also relevant in congregate settings.
Utility and equipment failure
Loss of power or water would affect lighting, cooking, cleaning, medical equipment and communication. A failure at night would be particularly difficult because fewer staff are on duty. Lift failure would make it harder to move residents with limited mobility, and failure of fire safety or security systems would weaken protection.
Extreme heat, heavy rainfall and haze
Singapore's Third National Climate Change Study projects many more days above 35°C and more intense rainfall by the end of the century. Elderly residents are especially vulnerable to heat stress. Flash floods, such as those along Tampines Avenue 10 on 20 August 2021, can stop staff, suppliers and transport from reaching the home. Transboundary haze, which pushed the Pollutant Standards Index (PSI) into the hazardous range in September 2015, would require JHA to keep residents indoors and protect those with heart or lung conditions, in line with Ministry of Health (MOH) advice.
Fire and damage to premises
A fire, even a small one, could make parts of the premises unusable and trigger resident relocation. Because JHA operates from one site, any serious damage affects all services. Evacuation is harder when most residents need assistance, as Chapter 5's assumption A7 recognises.
Supplier and partner disruption
JHA's critical services depend on external suppliers and partners for meals, laundry, cleaning, medication, transport and medical care. Dialysis treatment (CBF-3 Provision of dialysis treatment) is a clear example: residents who need dialysis cannot miss sessions safely, so disruption to the provider or to transport is a serious risk. A failure at a halal meal supplier would affect every resident within hours.
Loss of staff and key skills
Care depends on people. Staff absence during an epidemic, transport disruption, industrial action at a supplier or the sudden loss of a key person can all reduce JHA's ability to supervise residents and deliver care. Specialist roles, such as those supporting medication management or counselling, may be hard to replace quickly.
Technology failure and cyber-attack
Even a home that relies mostly on people uses technology for records, rosters, communication and payments. The CrowdStrike outage of 19 July 2024 showed how a single faulty update can disable computers widely, even though most affected Singapore systems recovered within a day. Ransomware or a data breach would add a data protection dimension and could affect Jamiyah Singapore's shared systems as well as JHA's own.
Resident safety incidents
Sector-specific threats include serious falls, a resident leaving the home unaccompanied, self-harm, aggression between residents, medication errors and outbreaks of food-borne illness. These incidents can trigger regulatory reporting, investigations and intense staff workload, which can in turn disrupt other services.
Regulatory, legal and reputational shocks
Regulatory action can itself disrupt residents. In June 2026, MOH gave notice that it intended to revoke the licence of a nursing home after an audit found systemic lapses in resident care, infection control and governance; residents were transferred, and an interim care team was deployed. Although that home was regulated under a different regime, the case shows how governance and care failures can escalate. Reputational damage after an incident could also affect donations, volunteer support and community trust in Jamiyah Singapore.
Sample Rating Scales
The scales below are a starting point. JHA should adjust them to match Jamiyah Singapore's enterprise risk management framework if one exists.
Table 9.1: Sample likelihood scale (illustrative)
| Score | Rating | Description |
|---|---|---|
| 1 | Rare | Could happen only in exceptional circumstances; not expected in the next 10 years |
| 2 | Unlikely | Could happen once in five to 10 years |
| 3 | Possible | Could happen once in two to five years |
| 4 | Likely | Expected to happen about once a year |
| 5 | Almost certain | Expected to happen several times a year |
Table 9.2: Sample impact scale (illustrative)
| Score | Resident safety and health | Continuity of care | Regulatory and governance | Reputation and trust |
|---|---|---|---|---|
| 1 Minimal | No harm | Brief delay to non-critical service | No reportable issue | No external interest |
| 2 Minor | Minor discomfort, no treatment needed | Tier 3–4 service delayed within tier | Internal report only | Limited local concern |
| 3 Moderate | Harm needing first aid or GP review | Tier 2 service delayed beyond 24 hours | Incident reportable to MSF | Family complaints; local media interest |
| 4 Major | Serious harm needing hospital care | Tier 1 service unavailable beyond 4 hours | MSF inquiry or formal follow-up | National media coverage; donor concern |
| 5 Severe | Death or multiple serious injuries | Multiple Tier 1 services lost; relocation needed | Regulatory enforcement or step-in | Sustained loss of public and partner trust |
Worked Example: An Infectious Disease Outbreak (R1)
This example follows one risk from BIA context to residual risk. All figures are illustrative.
BIA context. Supervision of residents (CBF-4), access to medical care, medication and vital signs checks (CBF-6 Access to medical care, medication and vital signs checks) and provision of meals (CBF-13 Provision of meals) are all Tier 1 services, to be restored within four hours. Each depends heavily on staff availability and residents being able to share communal spaces safely.
Threat and vulnerability. A respiratory outbreak spreads among residents and staff. JHA's vulnerabilities might include shared dormitories, staff working across all areas of the home, limited isolation rooms, and a modest stock of personal protective equipment.
Analysis. Given Singapore's experience since 2020 and the frequency of seasonal respiratory illness, likelihood is rated 4 (likely). Impact is rated 5 (severe), because an outbreak could cause serious illness among frail residents and reduce staff below safe levels for several Tier 1 services. The current rating is 4 × 5 = 20, very high.
Evaluation. The rating exceeds JHA's appetite for resident safety risk, so treatment is required and the risk is reported to Jamiyah Singapore's board.
Treatment. JHA decides to reduce both likelihood and impact. Actions might include a zoning plan that divides the premises into areas with fixed staff, a stock of protective equipment sufficient for a defined period, infection control training for all staff, an agreement with Jamiyah Singapore or agency providers for surge staff, and a video-call arrangement to maintain family access (CBF-12) if visits are suspended.
Residual risk. Likelihood remains 4, because outbreaks cannot be prevented entirely, but impact falls to 3 (moderate), because the home can contain spread and maintain Tier 1 services. The residual rating is 4 × 3 = 12, high but within a tolerable band, with the risk owner reviewing it quarterly.
Threat-Identification Checklist
Workshop participants can use this checklist to make sure no major category is missed:
- Could an infectious disease spread among residents or staff, and how would the home zone its premises?
- What happens if power, water or gas fails for 24 hours, especially at night?
- Which residents are most at risk from extreme heat or haze, and where are the cooler, cleaner-air areas?
- Could flooding or transport disruption stop staff, suppliers, or residents from reaching the home?
- Which services would stop if the lift, kitchen, laundry or security system failed?
- Which suppliers have no alternative, including meals, dialysis transport and medication?
- Which roles are held by only one or two trained people?
- Which records or systems are needed for Tier 1 services, and is there a paper fallback?
- What shared services does the home rely on from Jamiyah Singapore?
- Which resident safety incidents would require reporting to MSF?
- Could a regulatory finding or adverse media story disrupt operations?
- Would the plan still work during Ramadan or a public holiday period?
Presenting the Results to the Board
Board members need a clear, short picture, not the full register. JHA's report to Jamiyah Singapore's board or its delegated committee might include a one-page risk matrix, the top five risks with their owners and treatment status, any risks above appetite and the decisions or resources the board is asked to approve.
The report should also show movement. A risk that has fallen from very high to high because a zoning plan was tested is good news worth reporting. For example, JHA might present a short slide showing R1 moving from a rating of 20 to 12 after its first outbreak exercise, alongside a request for funding to expand its stock of protective equipment (illustrative). Reporting twice a year, as objective O8 proposes, keeps the board informed without overloading it.
Risk Matrix
The matrix shows where the illustrative risks in Table 9 fall, using the current ratings. Bands: 1–4 low, 5–9 medium, 10–14 high, 15–25 very high.
Table 9.3: Risk matrix for Jamiyah Home for the Aged (illustrative current ratings)
| Likelihood \ Impact | 1 Minimal | 2 Minor | 3 Moderate | 4 Major | 5 Severe |
|---|---|---|---|---|---|
| 5 Almost certain | |||||
| 4 Likely | R3 (12) | R9 (16) | R1 (20) | ||
| 3 Possible | R4, R5, R10 (9) | R2, R7, R11 (12) | |||
| 2 Unlikely | R6, R8, R12 (10) | ||||
| 1 Rare |
Summary Table
Table 9: Assessing Risks and Threats for Jamiyah Home for the Aged
| Ref | Threat category | Example scenario | Affected services or resources | Current rating (L × I) | Existing controls (illustrative) | Proposed treatment | ISO 22301 clause or regulatory link |
|---|---|---|---|---|---|---|---|
| R1 | Infectious disease | Respiratory outbreak among residents and staff | CBF-4, CBF-6, CBF-12, CBF-13; staff | 4 × 5 = 20 | Basic infection control; visitor screening | Zoning plan, protective equipment stock, surge staff, virtual family access | 8.2.3, 8.3; infection control guidance [verify] |
| R2 | Utility failure | Power or water lost for 24 hours, starting at night | CBF-2, CBF-4, CBF-5, CBF-13, CBF-14 | 3 × 4 = 12 | Emergency lighting | Backup power for essential areas; water storage; night procedure | 8.2.3, 8.4; SRHA Code (premises) [verify] |
| R3 | Extreme heat | Heatwave with cooling failure | CBF-2, CBF-4, CBF-6; residents | 4 × 3 = 12 | Fans; hydration routines | Heat plan, cool room, resident monitoring | 4.1 (Amd 1:2024), 8.2.3 |
| R4 | Flooding and transport | Flash floods stop staff and suppliers reaching Tampines | CBF-4, CBF-13, CBF-17; staff | 3 × 3 = 9 | Staff contact list | Shift-extension rules; local staff pool; supplier stock | 4.1, 8.2.3 |
| R5 | Haze | PSI in very unhealthy or hazardous range for a week | CBF-7, CBF-8, CBF-17; residents with heart or lung conditions | 3 × 3 = 9 | Indoor activities | Haze plan, masks, clean-air room, outing suspension | 4.1, 8.2.3; MOH haze advice |
| R6 | Fire | Kitchen fire makes part of premises unusable | All services; premises | 2 × 5 = 10 | Fire safety systems; evacuation drills | Relocation arrangement; assisted-evacuation plan | 8.3, 8.4; SRHA Code (premises) [verify] |
| R7 | Supplier failure | Halal meal supplier cannot deliver for 72 hours | CBF-13 | 3 × 4 = 12 | Single supplier contract | Standby caterer; ready-meal stock | 8.2.3, 8.3 |
| R8 | Medical service disruption | Dialysis provider or transport unavailable | CBF-3, CBF-17 | 2 × 5 = 10 | Booked appointments | Alternative provider and transport; escalation to MSF and hospital | 8.2.3, 8.3 |
| R9 | Staff shortage | 30% of staff absent for several weeks | CBF-4, CBF-6, CBF-9, CBF-13 | 4 × 4 = 16 | Overtime; ad hoc relief | Cross-training; agency and Jamiyah support; minimum staffing plan | 7.2, 8.3 |
| R10 | Technology and cyber | Ransomware or outage locks case records | CBF-1, CBF-6, CBF-10; records | 3 × 3 = 9 | Vendor IT support | Paper fallbacks; backups; Jamiyah IT recovery plan | 8.2.3, 8.3; PDPA; Code of Governance 4.4 |
| R11 | Resident safety incident | Resident leaves the home unaccompanied at night | CBF-4, CBF-5 | 3 × 4 = 12 | Access control; night rounds | Missing-resident procedure; access review | 8.4; SRHA Code (incident management) [verify] |
| R12 | Regulatory and reputational | Audit finding leads to MSF enforcement and media coverage | All services; governance | 2 × 5 = 10 | Internal reviews | Compliance map to SRHA Code; crisis communication plan | 4.2, 6.1; SRHA 2025 |
All ratings, controls and treatments are illustrative and must be confirmed through JHA's own risk workshops and BIA.
Key to services: CBF-1 Routine intake (fresh admission and re-admission); CBF-2 Provision of accommodation; CBF-3 Provision of dialysis treatment; CBF-4 Supervision of residents; CBF-5 Provision of security and access; CBF-6 Access to medical care, medication and vital signs checks; CBF-7 Day-to-day routine programmes; CBF-8 Occupational and physiotherapy; CBF-9 Management of cognitive and social engagement; CBF-10 Casework (ICP) and counselling; CBF-12 Facilitation of family access; CBF-13 Provision of meals; CBF-14 Provision of cleaning and toilet services; CBF-17 Provision of transportation.
Conclusion
JHA's highest risks, on this illustrative assessment, are an infectious disease outbreak and a sustained staff shortage, followed by utility failure, extreme heat, supplier failure and resident safety incidents. Several risks share the same underlying vulnerabilities: a single site, a small pool of trained staff and dependence on a few key suppliers. Addressing those vulnerabilities will reduce many risks at once.
JHA's immediate next steps are to agree its risk criteria with Jamiyah Singapore, run a workshop with each department, confirm the register and owners, and test the treatment for R1 in a tabletop exercise. The register will then sit alongside the BIA as the evidence base for continuity strategies in eBook 2.
The next chapter turns from threats to the services they threaten, examining JHA's critical business functions in detail.
Sources
- MSF: Welfare Homes
- MSF: About the Social Residential Homes Act
- MSF: Regulatory Requirements Under the SRHA
- LTCcovid: The COVID-19 Long-Term Care Situation in Singapore (July 2020)
- PMC: COVID-19 outbreak in nursing homes in Singapore
- NEA and MSE: Latest climate projections for Singapore (5 January 2024)
- Mothership: Vehicles trapped in Tampines Ave 10 flash floods (20 August 2021)
- Phys.org: Singapore air worsens to hazardous (September 2015)
- MOH: Haze advisory
- MDDI: Response to PQs on the CrowdStrike outage
- Mothership: Nursing home licence to be revoked over lapses (June 2026)
- Commissioner of Charities: Sharing on the Revised Code of Governance (April 2023)
Continue reading: Chapter 10, Identifying Critical Business Functions for Jamiyah Home for the Aged, examines the 17 critical services JHA must protect and how quickly each must be restored.
